Update Integration Instance
PUT/api/starshipit/integration-instances/:integration_instance
Updates a StarShipIt integration instance. All body fields are optional — send only what should change.
This endpoint currently requires session authentication; Personal Access Token scope support is in progress.
Merge semantics: top-level keys inside connection_settings and integration_settings are merged into the stored objects. Keys you send overwrite existing values; keys you omit are preserved. For example, sending only integration_settings.sync_days_back leaves the stored fulfillment routing untouched.
Body fields:
name(string, optional) — must remain unique across all integration instances.connection_settings(object, optional) — any ofapiKey,subscriptionKey,webhookSecret.integration_settings(object, optional) — any ofsync_days_back,order_start_date,fulfillment(withenabledWarehousesIds/automatedWarehousesIds).is_automatic_sync_enabled(boolean, optional).
A PATCH request to the same URL behaves identically to PUT.
Returns the full updated instance. Returns 422 when the new name is already taken; 404 when the instance does not exist.
Authentication: Requires Bearer token.
Requires the integrations.update permission.
connection_settings never contains saved credentials: each secret key (API keys, secrets, passwords, tokens) is left out and replaced by a has_<snake_case_key> boolean saying whether one is saved (apiKey → has_api_key, password → has_password). Credentials in connection_settings are merged into the saved ones: a key you leave out keeps its saved value, so send a secret only to replace it (the response never echoes it back). To remove the saved webhook secret, send connection_settings.webhookSecret: null.
With a webhook secret saved, SKU.io rejects any Starshipit tracking webhook that is unsigned or wrongly signed (HTTP 401: "Webhook rejected: the x-starshipit-signature header is missing or does not match. …"), so tracking updates stop until the same secret is entered in Starshipit (Settings → Tracking & notifications). Leave it blank to accept unsigned webhooks.
Request
Responses
- 200
- 401
- 403
- 404
- 422
- 429
OK
Response Headers
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden
Response Headers
Not found — no record with the given identifier (or the route does not exist). Verify the ID before retrying.
Validation failed — the body is a field → messages map (Laravel shape) or the platform envelope with a stable machine-readable code. Fix the payload and resubmit.
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.